tracecmd_iterate_events - Man Page

Read events from a trace file


#include <trace-cmd.h>

int tracecmd_iterate_events(struct tracecmd_input *handle,
                            cpu_set_t *cpus, int cpu_size,
                            int (*callback)(struct tracecmd_input *,
                                            struct tep_record *,
                                            int, void *),
                            void *callback_data);
int tracecmd_iterate_events_multi(struct tracecmd_input **handles,
                                  int nr_handles,
                                  int (*callback)(struct tracecmd_input *,
                                                           struct tep_record *,
                                                           int, void *),
                                  void *callback_data);
int tracecmd_follow_event(struct tracecmd_input *handle,
                          const char *system, const char *event_name,
                          int (*callback)(struct tracecmd_input *,
                                          struct tep_event *,
                                          struct tep_record *,
                                          int, void *),
                          void *callback_data);
struct tracecmd_filter *tracecmd_filter_add(struct tracecmd_input *handle,
                                            const char *filter_str, bool neg);


This set of APIs can be used to iterate over events after opening a trace file using one of the open functions like tracecmd_open(3) or tracecmd_open_fd(3).

The function tracecmd_iterate_events() will iterate through all the events in the trace file defined by handle, where handle is returned from one of the tracecmd_open(3) functions. It will call the callback() function on the events on the CPUs defined by cpus. The cpu_size must be the size of cpus (see CPU_SET(3)). If cpus is NULL, then cpu_size is ignored and callback() will be called for all events on all CPUs in the trace file. The callback_data is passed to the callback() as its last parameter. callback may be NULL, which is useful if tracecmd_follow_event() is used, but note if callback is NULL, then callback_data is ignored and not sent to the callback of tracecmd_follow_event().

The function tracecmd_iterate_events_multi() is similar to tracecmd_iterate_events() except that it allows to iterate over more than one trace file. If tracecmd agent(1) is used to get a trace file for both the host and guest, make sure that the host trace file is the first entry in handles and tracecmd_iterate_events_multi() will do the synchronization of the meta data for the guest files that come later in handles. handles is an array of trace file descriptors that were opened by tracecmd_open(3) and friends. Note, unlike tracecmd_iterate_events(), tracecmd_iterate_events_multi() does not filter on CPUs, as it will cause the API to become too complex in knowing which handle to filter the CPUs on. If CPU filtering is desired, then the callback should check the record→cpu to and return 0 if it is not the desired CPU to process. nr_handles denotes the number of elements in handles. The callback_data is passed to the callback as its last parameter. callback may be NULL, which is useful if tracecmd_follow_event() is used, but note if callback is NULL, then callback_data is ignored and not sent to the callback of tracecmd_follow_event().

The callback() for both tracecmd_iterate_events() and tracecmd_iterate_events_multi() is of the prototype:

int callback()(struct tracecmd_input *handle, struct tep_record *record, int cpu, void *data);

The handle is the same handle passed to tracecmd_iterate_events() or the current handle of handles passed to tracecmd_iterate_events_multi() that the record belongs to. The record is the current event record. The cpu is the current CPU being processed. Note, for tracecmd_iterate_events_multi() it may not be the actual CPU of the file, but the nth CPU of all the handles put together. Use record→cpu to get the actual CPU that the event is on.

The tracecmd_follow_event() function will attach to a trace file descriptor handle and call the callback when the event described by system and name matches an event in the iteration of tracecmd_iterate_events() or tracecmd_iterate_events_multi(). For tracecmd_iterate_events_multi(), the callback is only called if the handle matches the current trace file descriptor within handles. The callback_data is passed as the last parameter to the callback() function. Note, this callback() function will be called before the callback() function of either tracecmd_iterate_events() or tracecmd_iterate_events_multi().

The callback() prototype for *tracecmd_follow_event()_ is:

int callback()(struct tracecmd_input *handle, struct tep_event *event, struct tep_record *_record, int cpu, void *data);

The tracecmd_filter_add() function, adds a filter to handle that affects both tracecmd_iterate_events() and tracecmd_iterate_events_multi(). The filter_str is a character string defining a filter in a format that is defined by tep_filter_add_filter_str(3). If neg is true, then the events that match the filter will be skipped, otherwise the events that match will execute the callback() function in the iterators.

Return Value

Both tracecmd_iterate_events() and tracecmd_iterate_events_multi() return zero if they successfully iterated all events (handling the follow and filters appropriately). Or an error value, which can include returning a non-zero result from the callback() function.


#define _GNU_SOURCE
#include <sched.h>
#include <stdlib.h>
#include <getopt.h>
#include <trace-cmd.h>

struct private_data {
        int             cpu;
        const char      *file;

static int print_events(struct tracecmd_input *handle, struct tep_record *record, int cpu, void *data)
        static struct trace_seq seq;
        struct tep_handle *tep = tracecmd_get_tep(handle);
        struct private_data *pdata = tracecmd_get_private(handle);

        /* For multi handles we need this */
        if (pdata->cpu >= 0 && pdata->cpu != record->cpu)
                return 0;

        if (!seq.buffer)

        trace_seq_printf(&seq, "%s: ", pdata->file);
        tep_print_event(tep, &seq, record, "%6.1000d [%03d] %s-%d %s: %s\n",
                        TEP_PRINT_NAME, TEP_PRINT_INFO);
        return 0;

static int print_event(struct tracecmd_input *handle, struct tep_event *event,
                       struct tep_record *record, int cpu, void *data)
        return print_events(handle, record, cpu, data);

static void usage(const char *argv0)
        printf("usage: [-c cpu][-f filter][-e event] %s trace.dat [trace.dat ...]\n",

int main(int argc, char **argv)
        struct tracecmd_input **handles = NULL;
        const char *filter_str = NULL;
        const char *argv0 = argv[0];
        struct private_data *priv;
        cpu_set_t *cpuset = NULL;
        char *event = NULL;
        size_t cpusize = 0;
        int nr_handles = 0;
        int cpu = -1;
        int i;
        int c;

        while ((c = getopt(argc, argv, "c:f:e:")) >= 0) {
                switch (c) {
                case 'c':
                        /* filter all trace data to this one CPU. */
                        cpu = atoi(optarg);
                case 'f':
                        filter_str = optarg;
                case 'e':
                        event = optarg;
        argc -= optind;
        argv += optind;

        if (argc == 0)

        for (i = 0; i < argc; i++) {
                handles = realloc(handles, sizeof(*handles) * (nr_handles + 1));
                if (!handles)
                handles[nr_handles] = tracecmd_open(argv[i], 0);
                if (!handles[nr_handles]) {
                if (filter_str) {
                        if (tracecmd_filter_add(handles[nr_handles], filter_str, false) == NULL) {
                                perror("adding filter");
                priv = calloc(1, sizeof(*priv));
                if (!priv)
                priv->file = argv[i];
                priv->cpu = cpu;
                tracecmd_set_private(handles[nr_handles], priv);
                if (event) {
                        if (tracecmd_follow_event(handles[nr_handles], NULL, event, print_event, NULL) < 0) {
                                printf("Could not follow event %s for file %s\n", event, argv[i]);

        /* Shortcut */
        if (nr_handles == 1) {
                if (cpu >= 0) {
                        cpuset = CPU_ALLOC(cpu + 1);
                        if (!cpuset)
                        cpusize = CPU_ALLOC_SIZE(cpu + 1);
                        CPU_SET_S(cpu, cpusize, cpuset);
                if (event)
                        tracecmd_iterate_events(handles[0], cpuset, cpusize, NULL, NULL);
                        tracecmd_iterate_events(handles[0], cpuset, cpusize, print_events, NULL);
        } else {
                if (event)
                        tracecmd_iterate_events_multi(handles, nr_handles, NULL, NULL);
                        tracecmd_iterate_events_multi(handles, nr_handles, print_events, NULL);

        for (i = 0; i < nr_handles; i++) {
                priv = tracecmd_get_private(handles[i]);


        Header file to include in order to have access to the library APIs.
        Linker switch to add when building a program that uses the library.

See Also

libtracefs(3), libtraceevent(3), trace-cmd(1) trace-cmd.dat(5)


Steven Rostedt <[1]>
Tzvetomir Stoyanov <[2]>

Reporting Bugs

Report bugs to <[3]>


libtracecmd is Free Software licensed under the GNU LGPL 2.1



Copyright (C) 2020 VMware, Inc. Free use of this software is granted under the terms of the GNU Public License (GPL).



Referenced By

The man pages tracecmd_filter_add(3), tracecmd_follow_event(3) and tracecmd_iterate_events_multi(3) are aliases of tracecmd_iterate_events(3).

10/11/2022 libtracefs Manual